Law 25 makes you publish your privacy officer's contact. It doesn't make you hand it to spammers.

Most of what has been written about Québec's Law 25 comes from lawyers and privacy consultants. This is written from a different chair. I have spent 30 years in the email industry, mostly fighting spam, and LastSpam, our filtering company, has been in business since 2002. From where we sit, one small obligation in the law has a side effect nobody seems to talk about.

What the law actually asks

Section 3.1 of the Act respecting the protection of personal information in the private sector says:

The title and contact information of the person in charge of the protection of personal information must be published on the enterprise's website or, if the enterprise does not have a website, be made available by any other appropriate means.

Two details matter here:

• By default, that person is the one with the highest authority in the business. The same section gives the role to that person, often the owner or the CEO, unless they delegate it in writing.
• The law asks for a title and contact information. It does not ask for the person's name, and it does not say the contact has to be a personal mailbox.

So the question is not whether to publish. You have to. The question is how.

Québec is not alone. Europe's GDPR (art. 37(7)) requires organizations that must appoint a data protection officer to publish that officer's contact details. Brazil's LGPD (art. 41) wants the officer's identity and contact information public, preferably on the website. Singapore's PDPA (s. 11(5)) requires the business contact information of at least one responsible person to be available to the public. The same harvesting and forgery risk applies wherever those addresses are published.

What we found on 38 Québec websites

We looked at 38 Québec business websites that publish their privacy officer: law firms, accounting firms, compliance firms, web agencies and clinics. This is a small sample, not a census, and we name no one. The pattern was still clear:

Twenty-eight out of 38 put the address in the page as plain text. The seven "hidden" ones are not much better: Cloudflare's obfuscation stops the laziest scrapers, but anyone who wants the address can decode it with a few lines of code. So 28 of 38 hand the address to any crawler that reads the page, and 7 more to anyone who writes a short script.

Why a published address is a problem

An address on a public web page does not stay on that page. Robots crawl the web all day collecting addresses, and once one is collected it gets copied, sold and reused for years. After 30 years in anti-spam, I can tell you that removing it from the page later does not take it back out of those lists.

And this is not just any address. The privacy officer is the person whose job is to open mail from strangers and act on it: access requests, complaints, "here is a copy of my ID", "we think your client data leaked". An attacker could not ask for a better target, and the company's own website tells them who that is and how to reach them.

The part that makes it much worse: p=none

Now combine that published address with the company's own email domain.

If your domain has no DMARC record, or one at p=none, anyone can send email that says it comes from [email protected], and no one has been told to refuse it. With the name and address you published, they can write as your president to your whole company: every employee, your accounting team, even your clients. (Why p=none stops nothing)

So the attacker now has:

1. the exact address of the person who handles sensitive requests, published by you;
2. often, the boss's own address, because by default the boss is the privacy officer;
3. and a domain where a forged message "from" management is much more likely to reach anyone in the company.

That is everything needed for a convincing fake "please send me the client file" or "pay this breach-response invoice today", and it seems to come from inside your own company. This is not a rare situation. In our study of 296 Québec organizations, 24% had no DMARC record or sat at p=none.

How to comply without the exposure

None of this means breaking the law. It means meeting the obligation in a way that limits the damage.

• Use a role address, not a person's own address. [email protected] or [email protected], forwarding to whoever holds the role. It still gets harvested; it doesn't hide anything. What it protects is the person: the boss's own mailbox stays off the lists, the address survives staff changes, and you can filter it hard without touching anyone's personal mailbox. The law asks for a title, so a title-based address fits it naturally.
• Or use a contact form with bot protection, and keep a phone number beside it. That is the only option that keeps an address off the lists. Three of the 38 sites already do this.
• Don't count on obfuscation alone. Hiding the address in code slows down a few scrapers and none of the motivated ones.
• Filter that mailbox as if it will be targeted, because it will be. Opening attachments from strangers is part of that job, so this mailbox needs serious filtering more than any other.
• Move your domain past p=none. This is the step that matters most. With p=quarantine or p=reject, a message forged in your name gets junked or refused, including the ones aimed at your own staff. A harvested address is then good for ordinary spam, not a way in.

We are not lawyers, and this is not legal advice. If you are unsure how to word your privacy page, ask your counsel. The law sets the obligation; how you meet it is up to you.

Check where you stand

It takes a minute and it is free: check your domain here. If the result says no DMARC or p=none, your privacy officer's published address is easier to abuse than it should be. To see exactly which systems send email in your name before you tighten the policy, try our email tester.